CVE-2026-24125 Path Traversal in @tinacms/graphql
Attackers can escape collection directories via GraphQL mutations to read or modify arbitrary files, affecting TinaCMS users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24125?
CVE-2026-24125 is a medium-severity path traversal vulnerability in @tinacms graphql, published on 12 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are combined with the collection path using path.join() without validating that the resolved path remains within the collection root directory. Because path.join() does not prevent directory traversal, paths containing ../ sequences can escape the intended directory boundary. This vulnerability is fixed in 2.1.2.
Weakness: CWE-22
Which versions are affected by CVE-2026-24125?
2 open source packages ship an affected version, including @tinacms/graphql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@tinacms/graphql npm | All versions | 2.1.2 |
@tinacms/graphql npm | All versions | 2.1.2 |
Products include Ssw Tinacms\/Graphql.
How do I fix CVE-2026-24125?
Upgrade @tinacms/graphql to 2.1.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-24125 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24125 exists.
Other vulnerabilities in @tinacms graphql
Sources
Also known as GHSA-2238-xc5r-v9hj.